Cannot log into firewall if authentication profile specifies an AD group instead of AD username

[WinCo]

So last Thursday we upgraded our PA-5220s from 9.1.10 to 10.1.5-h1 and everything went incredibly well - absolutely no issues during the upgrade. About 15 hours after the upgrade was complete, we suddenly could not log onto the firewalls with our LDAP credentials. 

Typically we have an AD group specified in the Authentication profile we use for management access. If we keep that configuration, we cannot log into the firewalls. However, if we add individual AD users to the authentication profile, those users can log in with their LDAP credentials. I know the LDAP server profile is working because it is the same one used to allow Globalprotect users to authenticate, and that is working absolutely fine, and also uses AD groups. 

I checked User-ID group mappings and we have our domains entire tree selected, so I know the group is available for mappings. 

Here are some sanitized screenshots of the config: https://imgur.com/a/6tuXgHu

I have a case open with TAC but our engineer is in a vastly different timezone and hasn't been able to find time on their shift to assist. 

[kiwi]

Hi @WinCo ,

Any information that can help you further in the authd logs or in the LDAP logs ?

I know some default authentication behaviour changed from 9.1 to 10.x about the strict-username-check which might be worth checking:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/upgrade-pan-os/upgradedowngrade-co...

Cheers,

-Kiwi.